Officials at Europol announced on October 20, 2023, that the suspected developer of the Ragnar Locker ransomware group had been arrested by law enforcement in Paris, France. Law enforcement also conducted a search of the unnamed key target’s house in Czechia, seized the group’s ransomware infrastructure in Netherlands, Germany, and Sweden, and took down the group’s associated Tor data leak website. The successful takedown of one of the oldest continuously operating ransomware groups is another big step towards the international effort of stopping ransomware operators and cybercriminals. The French National Gendarmerie, along with law enforcement authorities from Czechia, Germany, Italy, Japan, Latvia, the Netherlands, Spain, Sweden, Ukraine, and the United States, conducted several raids and other coordinated operations to get the suspected developer of Ragnar group in front of the examining magistrates of the Paris Judicial Court. The Ragnar Locker ransomware gang first emerged in December 2019 and is believed to have conducted attacks against as many as one hundred sixty-eight (168) international companies since 2020, primarily targeting critical infrastructure entities across the world with notorious attacks on the computer chip manufacturer ADATA, aviation giants Dassault Falcon and Air Portugal, and the Greece natural gas operator DESFA. The Federal Bureau of Investigation (FBI) released another study detailing that the group’s ransomware had been deployed on the networks of at least fifty-two (52) critical infrastructure organizations between April 2020 and March 2022 in the United States alone. Ragnar Locker, which is the name of both the group and their ransomware strain, did not operate in the typical fashion of modern ransomware gangs who often deploy Ransomware-as-a-Service (RaaS) tactics. The group instead operated semi-privately and avoided the active recruitment of affiliates. There was a detailed organizational structure consisting of researchers who were in charge of discovering vulnerabilities combined with proficient hackers to deploy the ransomware once vulnerabilities had been discovered. The gang was well-known for double extortion, demanding ransoms for the data decryption tool and the guarantee of not releasing sensitive stolen information. CTIX analysts will continue to report on the ongoing dance between international law enforcement collaboration and cybercriminal activities.